Escape <!-- and I suppose --> about krumo HOT 6 CLOSED

You bring up a good point. Should we htmlentities() the entire output? I don't think I've ever krumo'd HTML strings before.

Should be a simple fix if we can figure out what ELSE might need escaping.

from krumo.

Might not be a bad idea...(htmlentities)

On May 4, 2015, at 10:32 AM, Scott Baker [email protected] wrote:

You bring up a good point. Should we htmlentities() the entire output? I
don't think I've ever krumo'd HTML strings before.

—
Reply to this email directly or view it on GitHub
https://github.com/oodle/krumo/issues/26#issuecomment-98787797.

from krumo.

I'm really surprised we haven't run in to this before. I'll have to do some investigation. Should be an easy fix though.

from krumo.

Sorry it too me so long to look at this. I'm not seeing the problem you're seeing. If I look at the code we're already escaping string output:

https://github.com/oodle/krumo/blob/master/class.krumo.php#L1452

Are you sure you're running the latest version?

from krumo.

@dmyers2004 any update on this issue?

from krumo.

Closing this issue because it's been more than 2 years. Will to re-open if it's still an issue.

from krumo.